T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:33
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-36`; `skill.json:20-29` **Vulnerability Type**: Unbounded third-party package installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:33-36`: ```bash pip install tushare>=1.3.0 pandas>=1.5.0 numpy>=1.21.0 ``` `skill.json:20-29`: ```json "dependencies": { "python": ">=3.8", "pip": [ "tushare>=1.3.0", "pandas>=1.5.0", "numpy>=1.21.0" ] }, "install": { "pip": "pip install tushare pandas numpy" } ``` ### Technical Analysis The Skill instructs users or the hosting framework to install packages directly from the default Python package index. None of the packages are pinned to an exact reviewed version, and no integrity hashes or lock file are supplied. The installation command in `skill.json` is less restrictive than the dependency declaration because it contains no version constraints at all. Consequently, the effective code installed and imported by the Skill can change after this package has been reviewed. Python packages can execute code during installation and whenever their modules are imported. Both operational scripts import `tushare`, while the market-data script additionally imports `pandas` and `numpy`. A compromised future release, dependency-confusion event, or compromise of a transitive dependency could therefore introduce arbitrary code into the Skill's execution path. ### Attack Path 1. An attacker compromises the publisher account, release process, or transitive dependency of one of the declared packages. 2. The attacker publishes a malicious version that still satisfies the open-ended constraints, or any version in the case of the unversioned installation command. 3. A user or Skill framework follows the documented installation instructions. 4. `pip` retrieves and installs the malicious release from the configured package index. 5. Malicious code executes during package installation or when the scripts import the affected package. 6. The malic ...[truncated 824 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version, for example: ```text tushare==<reviewed-version> pandas==<reviewed-version> numpy==<reviewed-version> ``` 2. Generate a reproducible lock file containing hashes for direct and transitive dependencies, and install with hash verification: ```bash pip install --require-hashes -r requirements.lock ``` 3. Make the dependency list and installation command in `skill.json` identical. Do not retain the unversioned `pip install tushare pandas numpy` command. 4. Use an organization-controlled package mirror or allowlisted package repository where possible. 5. Run dependency vulnerability and provenance checks in CI, including transitive dependency inspection. 6. Perform package installation in an isolated virtual environment or container with minimal filesystem access and no unnecessary credentials. 7. Separate dependency installation from runtime execution so that API credentials are not present during package installation. ]]>